Oracle Linux 7 : jss (ELSA-2019-3067)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3067 advisory. Thu Sep 12 2019 Dogtag PKI Team [email protected] 4.4.6-3 - NVR bump 4.4.6-2 - Bugzilla 1747966 - CVE 2019-14823 jss: OCSP policy 'Leaf and Chain' implicitly...

Man-in-the-Middle (MitM)

JSS is vulnerable to man-in-the-middle MitM. The vulnerability exists as the OCSP policy "Leaf and Chain" implicitly trusts the root certificate...

RHEL 7 : jss (RHSA-2019:3067)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3067 advisory. Java Security Services JSS provides an interface between Java Virtual Machine and Network Security Services NSS. It supports most of the security...

jss security update

Thu Sep 12 2019 Dogtag PKI Team - NVR bump 4.4.6-2 - Bugzilla 1747966 - CVE 2019-14823 jss: OCSP policy 'Leaf and Chain' implicitly trusts the root certificate...

CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

Design/Logic Flaw

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

CVE-2019-14823

The CVE-2019-14823 issue affects JSS: Leaf and Chain OCSP policy in CryptoManager (versions after 4.4.6, 4.5.3, 4.6.0) implicitly trusts the root certificate, potentially breaking chain verification and enabling MITM. Several connected advisories (Mageia MGASA-2020-0018, Red Hat RHSA-2019:3225, F...

Security Bulletin: Java vulnerability on IBM Storage DS8870 (CVE-2014-0411)

Summary IBM Enterprise Storage DS8870 HMC extensively uses Java, for which a fix is available for a security vulnerability. Vulnerability Details CVEID: CVE-2014-0411 DESCRIPTION: Java is used throughout the DS8870 HMC including the command line interface CLI and graphical user interface GUI and...

Solaris 10 (x86) : 119214-38

NSSNSPRJSS 3.35x86: NSPR 4.18 / NSS 3.35 / JSS 4.3.2. Date this patch was last updated by Sun : May/16/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid109884; scriptversion"1.6";...

Solaris 10 (sparc) : 119213-38

NSSNSPRJSS 3.35: NSPR 4.18 / NSS 3.35 / JSS 4.3.2. Date this patch was last updated by Sun : May/16/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid109882; scriptversion"1.6";...

Solaris 10 (x86) : 119214-33

NSSNSPRJSS 3.21x86: NSPR 4.11 / NSS 3.21 / JSS 4.3.2. Date this patch was last updated by Sun : Mar/22/16 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 10 (x86) : 125359-20

NSSNSPRJSS 3.17.2 Solarisx86: NSPR 4.10.7 / NSS 3.17.2 / JSS 4.. Date this patch was last updated by Sun : Feb/19/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 10 (sparc) : 125358-20

NSSNSPRJSS 3.17.2 Solaris: NSPR 4.10.7 / NSS 3.17.2 / JSS 4.3.2. Date this patch was last updated by Sun : Feb/19/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 10 (sparc) : 119213-32

NSSNSPRJSS 3.17.4: NSPR 4.10.7 / NSS 3.17.4 / JSS 4.3.2. Date this patch was last updated by Sun : Dec/24/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 10 (sparc) : 125358-15 (BEAST)

NSSNSPRJSS 3.13.1 Solaris: NSPR 4.8.9 / NSS 3.13.1 / JSS 4.3.2 M. Date this patch was last updated by Sun : Feb/08/12 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 10 (sparc) : 125358-22

NSSNSPRJSS 3.21 Solaris: NSPR 4.11 / NSS 3.21 / JSS 4.3.2 Mainte. Date this patch was last updated by Sun : Mar/22/16 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 10 (x86) : 125359-15 (BEAST)

NSSNSPRJSS 3.13.1 Solarisx86: NSPR 4.8.9 / NSS 3.13.1 / JSS 4.3. Date this patch was last updated by Sun : Feb/08/12 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...